KrbEtypeInsight

1.0.0

Predicts which accounts, services and clients a Kerberos encryption type hardening change
will break, before the change is made. Collects events 4768, 4769 and 4771 from domain
controllers or archived logs, decodes ticket encryption types and msDS-SupportedEncryptionTypes
bitmasks, correlates observed behaviour against directory configuration and domain baseline,
and
Predicts which accounts, services and clients a Kerberos encryption type hardening change
will break, before the change is made. Collects events 4768, 4769 and 4771 from domain
controllers or archived logs, decodes ticket encryption types and msDS-SupportedEncryptionTypes
bitmasks, correlates observed behaviour against directory configuration and domain baseline,
and emits a per-principal risk assessment naming the specific clients that will stop working.
Show more

Minimum PowerShell version

7.4

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name KrbEtypeInsight

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name KrbEtypeInsight

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 EntraVantage LLC. Licensed under the GNU General Public License v3.0.

Package Details

Author(s)

  • Jeffrey Stuhr

Tags

ActiveDirectory Kerberos Security RC4 AES Hardening Audit EventLog Windows

Functions

ConvertFrom-KrbEtype Get-KrbEvent Get-KrbPrincipalEtype Get-KrbDomainEtypeContext Get-KrbEtypeRisk Export-KrbEtypeReport

PSEditions

Core

Dependencies

This module has no dependencies.

Release Notes

1.0.0 - Initial release. Licensed under the GNU General Public License v3.0.

See CHANGELOG.md for the defects found and fixed during pre-release validation against a
live domain, and for known limitations.

- ConvertFrom-KrbEtype decodes both Kerberos numbering systems: RFC 3961 ticket encryption
 type numbers and MS-KILE msDS-SupportedEncryptionTypes bit flags, plus the client
 advertised encryption type name list from version 2 events.
- Get-KrbEvent collects 4768, 4769 and 4771 from live domain controllers or archived .evtx
 files, handling the version 0, 1 and 2 audit schemas.
- Get-KrbPrincipalEtype reads per-account configuration including the userAccountControl
 overrides that supersede the encryption type attribute.
- Get-KrbDomainEtypeContext establishes the baseline: functional level, per-controller
 DefaultDomainSupportedEncTypes including disagreement between controllers, krbtgt, and
 trust encryption types.
- Get-KrbEtypeRisk correlates all of the above into per-principal risk objects that name the
 specific clients a change will break.
- Export-KrbEtypeReport writes self-contained HTML, per-finding CSV, or full-fidelity JSON.

FileList

Version History

Version Downloads Last updated
1.0.0 (current version) 5 8/30/2026